diff --git a/agent/app/service/agents_hermes_channels.go b/agent/app/service/agents_hermes_channels.go
index dde2618f7983..4670ea784e67 100644
--- a/agent/app/service/agents_hermes_channels.go
+++ b/agent/app/service/agents_hermes_channels.go
@@ -4,6 +4,7 @@ import (
 	"path"
 
 	"github.com/1Panel-dev/1Panel/agent/app/dto"
+	"github.com/1Panel-dev/1Panel/agent/buserr"
 )
 
 const hermesWeixinLoginScript = `import asyncio
@@ -50,12 +51,12 @@ func readHermesQQBotChannelConfig(confDir string) (*dto.AgentQQBotConfig, error)
 	if dmPolicy == "" {
 		dmPolicy = "open"
 	}
-	allowFrom := extractStringList(extra["allow_from"])
+	allowFrom := splitHermesEnvList(envMap["QQ_ALLOWED_USERS"])
 	groupPolicy := extractStringValue(extra["group_policy"])
 	if groupPolicy == "" {
 		groupPolicy = "open"
 	}
-	groupAllowFrom := extractStringList(extra["group_allow_from"])
+	groupAllowFrom := splitHermesEnvList(envMap["QQ_GROUP_ALLOWED_USERS"])
 
 	result := &dto.AgentQQBotConfig{
 		Enabled:        extractBoolValue(platform["enabled"], false) && appID != "" && clientSecret != "",
@@ -92,15 +93,27 @@ func writeHermesQQBotChannelConfig(confDir string, config dto.AgentQQBotConfig)
 	envMap["QQ_APP_ID"] = defaultBot.AppID
 	envMap["QQ_CLIENT_SECRET"] = defaultBot.ClientSecret
 	delete(envMap, "QQ_ALLOWED_USERS")
+	delete(envMap, "QQ_GROUP_ALLOWED_USERS")
 	delete(envMap, "QQ_ALLOW_ALL_USERS")
 	delete(envMap, "QQ_MARKDOWN_SUPPORT")
 	if config.DmPolicy == "open" {
 		envMap["QQ_ALLOW_ALL_USERS"] = "true"
+	} else if config.DmPolicy == "allowlist" {
+		if allow := joinHermesEnvList(config.AllowFrom); allow != "" {
+			envMap["QQ_ALLOWED_USERS"] = allow
+		}
+	}
+	if config.GroupPolicy == "allowlist" {
+		if allow := joinHermesEnvList(config.GroupAllowFrom); allow != "" {
+			envMap["QQ_GROUP_ALLOWED_USERS"] = allow
+		}
 	}
 	if err := writeHermesEnvMap(envPath, envMap, []string{
 		"QQ_APP_ID",
 		"QQ_CLIENT_SECRET",
 		"QQ_ALLOW_ALL_USERS",
+		"QQ_ALLOWED_USERS",
+		"QQ_GROUP_ALLOWED_USERS",
 		"QQ_HOME_CHANNEL",
 		"QQ_HOME_CHANNEL_NAME",
 		"QQ_STT_API_KEY",
@@ -143,6 +156,7 @@ func deleteHermesQQBotChannelConfig(confDir string) error {
 		"QQ_CLIENT_SECRET",
 		"QQ_ALLOW_ALL_USERS",
 		"QQ_ALLOWED_USERS",
+		"QQ_GROUP_ALLOWED_USERS",
 		"QQ_HOME_CHANNEL",
 		"QQ_HOME_CHANNEL_NAME",
 		"QQ_STT_API_KEY",
@@ -165,21 +179,17 @@ func readHermesWecomChannelConfig(confDir string) (*dto.AgentWecomConfig, error)
 	}
 
 	platform := childMap(childMap(cfg, "platforms"), "wecom")
-	extra := childMap(platform, "extra")
-	allowFrom := extractStringList(extra["allow_from"])
-	if len(allowFrom) == 0 {
-		allowFrom = splitHermesEnvList(envMap["WECOM_ALLOWED_USERS"])
-	}
-	groupAllowFrom := extractStringList(extra["group_allow_from"])
+	allowFrom := splitHermesEnvList(envMap["WECOM_ALLOWED_USERS"])
+	groupAllowFrom := splitHermesEnvList(envMap["WECOM_GROUP_ALLOWED_USERS"])
 	dmPolicy := "pairing"
-	if extractHermesEnvBool(envMap, "WECOM_ALLOW_ALL_USERS", false) {
+	if envMap["WECOM_DM_POLICY"] == "open" {
 		dmPolicy = "open"
 	} else if len(allowFrom) > 0 {
 		dmPolicy = "allowlist"
-	} else if policy := extractStringValue(extra["dm_policy"]); policy != "" {
+	} else if policy := envMap["WECOM_DM_POLICY"]; policy != "" {
 		dmPolicy = policy
 	}
-	groupPolicy := extractStringValue(extra["group_policy"])
+	groupPolicy := envMap["WECOM_GROUP_POLICY"]
 	if groupPolicy == "" {
 		groupPolicy = "open"
 	}
@@ -215,22 +225,33 @@ func writeHermesWecomChannelConfig(confDir string, config dto.AgentWecomConfig)
 		delete(envMap, "WECOM_SECRET")
 	}
 	delete(envMap, "WECOM_ALLOWED_USERS")
+	delete(envMap, "WECOM_GROUP_ALLOWED_USERS")
 	delete(envMap, "WECOM_ALLOW_ALL_USERS")
 	delete(envMap, "WECOM_DM_POLICY")
 	delete(envMap, "WECOM_GROUP_POLICY")
-	switch config.DmPolicy {
-	case "open":
-		envMap["WECOM_ALLOW_ALL_USERS"] = "true"
-	case "allowlist":
+	if config.DmPolicy != "" {
+		envMap["WECOM_DM_POLICY"] = config.DmPolicy
+	}
+	if config.GroupPolicy != "" {
+		envMap["WECOM_GROUP_POLICY"] = config.GroupPolicy
+	}
+	if config.DmPolicy == "allowlist" {
 		if allow := joinHermesEnvList(config.AllowFrom); allow != "" {
 			envMap["WECOM_ALLOWED_USERS"] = allow
 		}
 	}
+	if config.GroupPolicy == "allowlist" {
+		if allow := joinHermesEnvList(config.GroupAllowFrom); allow != "" {
+			envMap["WECOM_GROUP_ALLOWED_USERS"] = allow
+		}
+	}
 	if err := writeHermesEnvMap(envPath, envMap, []string{
 		"WECOM_BOT_ID",
 		"WECOM_SECRET",
-		"WECOM_ALLOW_ALL_USERS",
+		"WECOM_DM_POLICY",
 		"WECOM_ALLOWED_USERS",
+		"WECOM_GROUP_POLICY",
+		"WECOM_GROUP_ALLOWED_USERS",
 	}); err != nil {
 		return err
 	}
@@ -265,7 +286,10 @@ func deleteHermesWecomChannelConfig(confDir string) error {
 		"WECOM_BOT_ID",
 		"WECOM_SECRET",
 		"WECOM_ALLOW_ALL_USERS",
+		"WECOM_DM_POLICY",
 		"WECOM_ALLOWED_USERS",
+		"WECOM_GROUP_POLICY",
+		"WECOM_GROUP_ALLOWED_USERS",
 		"WECOM_HOME_CHANNEL",
 	); err != nil {
 		return err
@@ -448,6 +472,9 @@ func writeHermesFeishuChannelConfig(confDir string, config dto.AgentFeishuConfig
 		return err
 	}
 	bot := firstHermesFeishuBot(config.Bots)
+	if config.GroupPolicy == "allowlist" && bot.DmPolicy == "pairing" {
+		return buserr.New("ErrHermesFeishuGroupAllowlistRequiresAllowlist")
+	}
 	if bot.AppID != "" {
 		envMap["FEISHU_APP_ID"] = bot.AppID
 	} else {
@@ -471,6 +498,11 @@ func writeHermesFeishuChannelConfig(confDir string, config dto.AgentFeishuConfig
 			envMap["FEISHU_ALLOWED_USERS"] = allow
 		}
 	}
+	if config.GroupPolicy == "allowlist" {
+		if allow := joinHermesEnvList(bot.AllowFrom); allow != "" {
+			envMap["FEISHU_ALLOWED_USERS"] = allow
+		}
+	}
 	if err := writeHermesEnvMap(envPath, envMap, []string{
 		"FEISHU_APP_ID",
 		"FEISHU_APP_SECRET",
diff --git a/agent/i18n/lang/en.yaml b/agent/i18n/lang/en.yaml
index 3d6c04b5bcf4..e6e19af833e2 100644
--- a/agent/i18n/lang/en.yaml
+++ b/agent/i18n/lang/en.yaml
@@ -66,6 +66,7 @@ ErrAgentWebsiteTypeUnsupported: 'Only proxy or static websites can be bound'
 ErrAgentWebsiteInUse: 'This website is already bound to another agent'
 ErrAgentWebsiteUnbindUnsupported: 'Deployment websites cannot be unbound manually'
 ErrHermesPairingCodeUnavailable: 'The pairing code is temporarily unavailable in Hermes, possibly due to network issues. Please try again later.'
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: 'When the Feishu group policy is Allowlist, the DM policy cannot be Pairing Code.'
 
 #backup
 Localhost: 'Local'
diff --git a/agent/i18n/lang/es-ES.yaml b/agent/i18n/lang/es-ES.yaml
index 11f94a34fc69..f1124bc52833 100644
--- a/agent/i18n/lang/es-ES.yaml
+++ b/agent/i18n/lang/es-ES.yaml
@@ -61,6 +61,7 @@ ErrAgentWebsiteTypeUnsupported: 'Solo se pueden vincular sitios proxy o estátic
 ErrAgentWebsiteInUse: 'Este sitio web ya está vinculado a otro agente'
 ErrAgentWebsiteUnbindUnsupported: 'Los sitios web de despliegue no se pueden desvincular manualmente'
 ErrHermesPairingCodeUnavailable: 'El código de emparejamiento no está disponible temporalmente en Hermes, posiblemente por un problema de red. Inténtalo de nuevo más tarde.'
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: 'Cuando la política de grupo de Feishu es Lista permitida, la política de MD no puede ser Código de emparejamiento.'
 Localhost: 'Máquina local'
 ErrBackupInUsed: 'Cuenta de respaldo en uso por tarea programada'
 ErrBackupCheck: 'Conexión de respaldo falló: {{ .err }}'
diff --git a/agent/i18n/lang/ja.yaml b/agent/i18n/lang/ja.yaml
index 8f130061b9d7..abce78493b17 100644
--- a/agent/i18n/lang/ja.yaml
+++ b/agent/i18n/lang/ja.yaml
@@ -61,6 +61,7 @@ ErrAgentWebsiteTypeUnsupported: '関連付けできるのはプロキシサイ
 ErrAgentWebsiteInUse: 'このサイトはすでに別のエージェントに関連付けられています'
 ErrAgentWebsiteUnbindUnsupported: 'ワンクリックデプロイのサイトは手動で関連解除できません'
 ErrHermesPairingCodeUnavailable: 'Hermes でペアリングコードが一時的に見つかりません。ネットワーク要因の可能性があるため、しばらくしてから再試行してください。'
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: 'Feishu のグループポリシーが許可リストの場合、DM ポリシーをペアリングコードにはできません。'
 Localhost: 'ローカルマシン'
 ErrBackupInUsed: 'バックアップアカウントがスケジュールで使用中'
 ErrBackupCheck: '接続テストに失敗しました: {{ .err }}'
diff --git a/agent/i18n/lang/ko.yaml b/agent/i18n/lang/ko.yaml
index caafa851052b..9614b8c6bafb 100644
--- a/agent/i18n/lang/ko.yaml
+++ b/agent/i18n/lang/ko.yaml
@@ -61,6 +61,7 @@ ErrAgentWebsiteTypeUnsupported: '프록시 또는 정적 웹사이트만 연결
 ErrAgentWebsiteInUse: '이 웹사이트는 이미 다른 에이전트에 연결되어 있습니다'
 ErrAgentWebsiteUnbindUnsupported: '원클릭 배포 웹사이트는 수동으로 연결 해제할 수 없습니다'
 ErrHermesPairingCodeUnavailable: 'Hermes에서 페어링 코드가 일시적으로 존재하지 않습니다. 네트워크 문제일 수 있으니 잠시 후 다시 시도해 주세요.'
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: 'Feishu 그룹 정책이 허용 목록이면 DM 정책을 페어링 코드로 설정할 수 없습니다.'
 Localhost: '로컬 머신'
 ErrBackupInUsed: '백업 계정이 예약에 사용 중'
 ErrBackupCheck: '연결 테스트 실패: {{ .err }}'
diff --git a/agent/i18n/lang/ms.yaml b/agent/i18n/lang/ms.yaml
index 55b3c03a158b..319dfb4c1578 100644
--- a/agent/i18n/lang/ms.yaml
+++ b/agent/i18n/lang/ms.yaml
@@ -61,6 +61,7 @@ ErrAgentWebsiteTypeUnsupported: 'Hanya laman web proxy atau statik boleh dipautk
 ErrAgentWebsiteInUse: 'Laman web ini sudah dipautkan ke ejen lain'
 ErrAgentWebsiteUnbindUnsupported: 'Laman web one-click deployment tidak menyokong nyahikat manual'
 ErrHermesPairingCodeUnavailable: 'Kod pasangan buat sementara waktu tidak wujud dalam Hermes, mungkin disebabkan masalah rangkaian. Sila cuba lagi sebentar nanti.'
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: 'Apabila dasar kumpulan Feishu ialah senarai benarkan, dasar DM tidak boleh menggunakan kod pasangan.'
 Localhost: 'Mesin Tempatan'
 ErrBackupInUsed: 'Akaun sandaran sedang digunakan oleh tugas'
 ErrBackupCheck: 'Ujian sambungan gagal: {{ .err }}'
diff --git a/agent/i18n/lang/pt-BR.yaml b/agent/i18n/lang/pt-BR.yaml
index af1e0cf4b9d5..1d3df6cba237 100644
--- a/agent/i18n/lang/pt-BR.yaml
+++ b/agent/i18n/lang/pt-BR.yaml
@@ -61,6 +61,7 @@ ErrAgentWebsiteTypeUnsupported: 'Somente sites proxy ou estáticos podem ser vin
 ErrAgentWebsiteInUse: 'Este site já está vinculado a outro agente'
 ErrAgentWebsiteUnbindUnsupported: 'Sites implantados em um clique não podem ser desvinculados manualmente'
 ErrHermesPairingCodeUnavailable: 'O código de pareamento está temporariamente indisponível no Hermes, possivelmente por causa de rede. Tente novamente mais tarde.'
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: 'Quando a política de grupo do Feishu é Lista de permissões, a política de DM não pode ser Código de pareamento.'
 Localhost: 'Máquina Local'
 ErrBackupInUsed: 'Conta de backup em uso por tarefa'
 ErrBackupCheck: 'Teste de conexão falhou: {{ .err }}'
diff --git a/agent/i18n/lang/ru.yaml b/agent/i18n/lang/ru.yaml
index 9f9dc266daec..f9655250fe71 100644
--- a/agent/i18n/lang/ru.yaml
+++ b/agent/i18n/lang/ru.yaml
@@ -61,6 +61,7 @@ ErrAgentWebsiteTypeUnsupported: 'Можно связывать только prox
 ErrAgentWebsiteInUse: 'Этот сайт уже связан с другим агентом'
 ErrAgentWebsiteUnbindUnsupported: 'Сайты one-click deployment нельзя отвязать вручную'
 ErrHermesPairingCodeUnavailable: 'Код сопряжения временно недоступен в Hermes, возможно из-за проблем с сетью. Повторите попытку позже.'
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: 'Когда групповая политика Feishu — белый список, политика личных сообщений не может быть кодом сопряжения.'
 Localhost: 'Локальная машина'
 ErrBackupInUsed: 'Аккаунт бэкапа занят задачей'
 ErrBackupCheck: 'Проверка подключения не удалась: {{ .err }}'
diff --git a/agent/i18n/lang/tr.yaml b/agent/i18n/lang/tr.yaml
index a2bfd83fa57a..01ef4cd52efe 100644
--- a/agent/i18n/lang/tr.yaml
+++ b/agent/i18n/lang/tr.yaml
@@ -61,6 +61,7 @@ ErrAgentWebsiteTypeUnsupported: 'Yalnızca proxy veya statik web siteleri bağla
 ErrAgentWebsiteInUse: 'Bu web sitesi zaten başka bir ajana bağlı'
 ErrAgentWebsiteUnbindUnsupported: 'Tek tıkla dağıtılan web sitelerinin bağlantısı manuel olarak kaldırılamaz'
 ErrHermesPairingCodeUnavailable: 'Eşleştirme kodu Hermes içinde geçici olarak bulunamıyor; bu durum ağ kaynaklı olabilir. Lütfen daha sonra tekrar deneyin.'
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: 'Feishu grup ilkesi izin listesi olduğunda, DM ilkesi eşleştirme kodu olamaz.'
 Localhost: 'Yerel Makine'
 ErrBackupInUsed: 'Yedek hesabı görevde kullanılıyor'
 ErrBackupCheck: 'Bağlantı testi başarısız: {{ .err }}'
diff --git a/agent/i18n/lang/zh-Hant.yaml b/agent/i18n/lang/zh-Hant.yaml
index 0b11e1a280bc..102b9d69efe3 100644
--- a/agent/i18n/lang/zh-Hant.yaml
+++ b/agent/i18n/lang/zh-Hant.yaml
@@ -61,6 +61,7 @@ ErrAgentWebsiteTypeUnsupported: '只能關聯反向代理或靜態網站'
 ErrAgentWebsiteInUse: '該網站已被其他智能體關聯'
 ErrAgentWebsiteUnbindUnsupported: '一鍵部署網站不支援手動解綁'
 ErrHermesPairingCodeUnavailable: '配對碼在 Hermes 中暫時不存在，可能是由於網路原因，請稍後再試'
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: '飛書群組策略為白名單時，私聊策略不能為配對碼'
 Localhost: '本機'
 ErrBackupInUsed: '此備份帳號已在排程任務中使用，無法刪除'
 ErrBackupCheck: '備份帳號測試連線失敗{{ .err }}'
diff --git a/agent/i18n/lang/zh.yaml b/agent/i18n/lang/zh.yaml
index acf1450da833..8b1d40f83fb2 100644
--- a/agent/i18n/lang/zh.yaml
+++ b/agent/i18n/lang/zh.yaml
@@ -66,6 +66,7 @@ ErrAgentWebsiteTypeUnsupported: "只能关联反向代理或静态网站"
 ErrAgentWebsiteInUse: "该网站已被其他智能体关联"
 ErrAgentWebsiteUnbindUnsupported: "一键部署网站不支持手动解绑"
 ErrHermesPairingCodeUnavailable: "配对码在 hermes 中暂时不存在，可能是由于网络原因，请稍后尝试"
+ErrHermesFeishuGroupAllowlistRequiresAllowlist: "飞书群组策略为白名单时，私聊策略不能为配对码"
 
 #backup
 Localhost: '本机'
diff --git a/frontend/src/views/ai/agents/agent/config/tabs/channels/hermes/feishu.vue b/frontend/src/views/ai/agents/agent/config/tabs/channels/hermes/feishu.vue
index 9f65a3ea8a8c..bb11af585c66 100644
--- a/frontend/src/views/ai/agents/agent/config/tabs/channels/hermes/feishu.vue
+++ b/frontend/src/views/ai/agents/agent/config/tabs/channels/hermes/feishu.vue
@@ -13,20 +13,15 @@
         </el-form-item>
         <el-form-item :label="t('aiTools.agents.dmPolicy')" prop="dmPolicy">
             <el-select v-model="form.dmPolicy">
-                <el-option :label="t('aiTools.agents.pairingCode')" value="pairing" />
+                <el-option
+                    :label="t('aiTools.agents.pairingCode')"
+                    value="pairing"
+                    :disabled="form.groupPolicy === 'allowlist'"
+                />
                 <el-option :label="t('aiTools.agents.policyOpen')" value="open" />
                 <el-option :label="t('aiTools.agents.policyAllowlist')" value="allowlist" />
             </el-select>
         </el-form-item>
-        <el-form-item v-if="form.dmPolicy === 'allowlist'" :label="t('aiTools.agents.allowFrom')" prop="allowFromText">
-            <el-input
-                v-model="form.allowFromText"
-                type="textarea"
-                :rows="3"
-                :placeholder="t('aiTools.agents.allowFromPlaceholder')"
-            />
-            <span class="input-help">{{ t('aiTools.agents.allowFromHelper') }}</span>
-        </el-form-item>
         <el-form-item :label="t('aiTools.agents.groupPolicy')" prop="groupPolicy">
             <el-select v-model="form.groupPolicy">
                 <el-option :label="t('aiTools.agents.policyOpen')" value="open" />
@@ -34,6 +29,18 @@
                 <el-option :label="t('aiTools.agents.policyDisabled')" value="disabled" />
             </el-select>
         </el-form-item>
+        <el-form-item
+            v-if="form.dmPolicy === 'allowlist' || form.groupPolicy === 'allowlist'"
+            :label="t('aiTools.agents.policyAllowlist')"
+            prop="allowFromText"
+        >
+            <el-input
+                v-model="form.allowFromText"
+                type="textarea"
+                :rows="3"
+                :placeholder="t('aiTools.agents.allowFromPlaceholder')"
+            />
+        </el-form-item>
         <el-form-item>
             <el-button type="primary" :loading="saving" @click="save">
                 {{ t('commons.button.save') }}
@@ -54,7 +61,7 @@
 </template>
 
 <script setup lang="ts">
-import { reactive, ref } from 'vue';
+import { reactive, ref, watch } from 'vue';
 import { ElMessageBox, type FormInstance } from 'element-plus';
 import { useI18n } from 'vue-i18n';
 import {
@@ -90,6 +97,15 @@ const form = reactive<FeishuForm>({
     groupPolicy: 'allowlist',
 });
 
+watch(
+    () => form.groupPolicy,
+    (value) => {
+        if (value === 'allowlist' && form.dmPolicy === 'pairing') {
+            form.dmPolicy = 'allowlist';
+        }
+    },
+);
+
 const parseTextList = (value: string): string[] => {
     return Array.from(
         new Set(
@@ -109,7 +125,10 @@ const rules = reactive({
     allowFromText: [
         {
             validator: (_rule, value, callback) => {
-                if (form.dmPolicy === 'allowlist' && parseTextList(String(value || '')).length === 0) {
+                if (
+                    (form.dmPolicy === 'allowlist' || form.groupPolicy === 'allowlist') &&
+                    parseTextList(String(value || '')).length === 0
+                ) {
                     callback(new Error(t('aiTools.agents.allowFromRequired')));
                     return;
                 }
@@ -158,7 +177,7 @@ const save = async () => {
                     appId: form.appId,
                     appSecret: form.appSecret,
                     dmPolicy: form.dmPolicy,
-                    allowFrom: form.dmPolicy === 'allowlist' ? allowFrom : [],
+                    allowFrom: form.dmPolicy === 'allowlist' || form.groupPolicy === 'allowlist' ? allowFrom : [],
                 },
             ],
         });
@@ -222,11 +241,4 @@ defineExpose({
 });
 </script>
 
-<style scoped lang="scss">
-.input-help {
-    display: block;
-    margin-top: 8px;
-    color: var(--el-text-color-secondary);
-    font-size: 12px;
-}
-</style>
+<style scoped lang="scss"></style>